JVN#52557009 La!cooda WIZ and LacoodaST vulnerable to cross-site scripting

Overview

La!cooda WIZ and LacoodaST contain a cross-site scripting vulnerability.

Products Affected

La!cooda WIZ 1.4.0 and earlier
LacoodaST 2.1.3 and earlier

For more information, refer to the vendors' websites.

Description

La!cooda WIZ from System Consultants Co., Ltd. and LacoodaST from SpaceTag, Inc. are groupware providing schedule and task managements, etc. La!cooda WIZ and LacoodaST contain a cross-site scripting vulnerability.

Impact

An arbitrary script could be executed on the web browser of the user who logged into La!cooda WIZ or LacoodaST.

Solution

Update the Software
Apply the latest updates provided by the vendors.
For more information, refer to the vendors' websites.

Vendor Status

Vendor	Link
System Consultants Co., Ltd.	About multiple vulnerabilities in La!cooda WIZ
SpaceTag, Inc.	About multiple vulnerabilities in LacoodaST

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Analyzed on 2008.08.21

Measures	Conditions	Severity
Access Required	Routed - can be attacked over the Internet using packets	High
Authentication	None - anonymous or no authentication (IP addresses do not count)	High
User Interaction Required	Simple - the user must be convinced to take a standard action that does not feel harmful to most users, such as click on a link or view a file	Medium
Exploit Complexity	Low-Medium - some expertise and/or luck required (most buffer overflows, guessing correctly in small space, expertise in Windows function calls)	Medium-High

Description of each analysis measures

Credit

Hirotaka Katagiri reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE	CVE-2008-3739
JVN iPedia	JVNDB-2008-000048